iptables script probleem - Linux en overige clients

dinsdag 7 augustus 2001 22:22
Acties:
wa' seggie?
Topicstarter
Ik gebruik het volgende iptables script (Uit de OpenNA boeken) voor mijn firewall.
Nu werkt het goed op de firewall zelf (uitgeklede rh 7.1) alleen op de clients gebeurd niet veel.
In IE lijkt het alsof er contact gemaakt is met een pagina, er staat weblocatie gevonden, maar daar blijft ie steken.

Kernel is 2.4.7 monolithic dus geen iptables modules, maar rechtstreeks in de kernel meegebakken.

het script:
code:
#!/bin/sh
#
# ----------------------------------------------------------------------------
# Copyright (C) 1999, 2001 OpenNA.com
# Last modified by Gerhard Mourani:  04-01-2001 <http://www.openna.com/>
# This firewall configuration is suitable for Gateway & Proxy Server.
# ----------------------------------------------------------------------------
#
# Invoked from /etc/rc.d/init.d/iptables.
# chkconfig: - 60 95
# description: Starts and stops the IPTABLES packet filter \
#         used to provide firewall network services.

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
if [ ${NETWORKING} = "no" ]
then
      exit 0
fi

if [ ! -x /sbin/iptables ]; then
    exit 0
fi

# See how we were called.
case "$1" in
  start)
      echo -n "Starting Firewalling: "

# ----------------------------------------------------------------------------
#  Some definitions for easy maintenance.
#  EDIT THESE TO SUIT YOUR SYSTEM AND ISP.

IPADDR=`ifconfig eth0 | fgrep -i inet | cut -d : -f 2 | cut -d \  -f 1`
EXTERNAL_INTERFACE="eth0"                # Internet connected interface
LOOPBACK_INTERFACE="lo"              # Your local naming convention
LOCAL_INTERFACE_1="eth1"                # Your Internal LAN interface
INTRANET="10.0.0.0/24"                 # Your Private IP Addr Range
PRIMARY_NAMESERVER="212.142.28.66"          # Your Primary Name Server
SECONDARY_NAMESERVER="212.142.28.130"         # Your Secondary Name Server
#SYSLOG_SERVER="***.**.**.*"                 # Your Syslog Internal Server

LOOPBACK="127.0.0.0/8"                # Reserved loopback address range
CLASS_A="10.0.0.0/8"                    # Class A private networks
CLASS_B="172.16.0.0/12"              # Class B private networks
CLASS_C="192.168.0.0/16"                # Class C private networks
CLASS_D_MULTICAST="224.0.0.0/4"          # Class D multicast addr
CLASS_E_RESERVED_NET="240.0.0.0/5"        # Class E reserved addr
BROADCAST_SRC="0.0.0.0"              # Broadcast source addr
BROADCAST_DEST="255.255.255.255"            # Broadcast destination addr
PRIVPORTS="0:1023"                  # Privileged port range
UNPRIVPORTS="1024:"                  # Unprivileged port range

# ----------------------------------------------------------------------------

# The SSH client starts at 1023 and works down to 513 for each
# additional simultaneous connection originating from a privileged port.
# Clients can optionally be configured to use only unprivileged ports.
SSH_LOCAL_PORTS="1022:65535"              # Port range for local clients
SSH_REMOTE_PORTS="513:65535"              # Port range for remote clients

# traceroute usually uses -S 32769:65535 -D 33434:33523
TRACEROUTE_SRC_PORTS="32769:65535"
TRACEROUTE_DEST_PORTS="33434:33523"

# ----------------------------------------------------------------------------

# FIREWALL MODULES
# ----------------

    # Uncomment all of the following modules lines only
    # for modularized kernel system.

    # These modules are necessary to masquerade their respective services.
#    /sbin/modprobe ip_tables
#    /sbin/modprobe iptable_nat
#    /sbin/modprobe ip_conntrack
#    /sbin/modprobe ip_conntrack_ftp
#    /sbin/modprobe ip_tables
#    /sbin/modprobe ip_nat_ftp
#    /sbin/modprobe ipt_LOG
#    /sbin/modprobe ipt_MARK
#    /sbin/modprobe ipt_MASQUERADE
#    /sbin/modprobe ipt_REDIRECT
#    /sbin/modprobe ipt_REJECT
#    /sbin/modprobe ipt_TOS
#    /sbin/modprobe ipt_limit
#    /sbin/modprobe ipt_mac
#    /sbin/modprobe ipt_mark
#    /sbin/modprobe ipt_multiport
#    /sbin/modprobe ipt_state
#    /sbin/modprobe ipt_tos
#    /sbin/modprobe iptable_mangle

# ----------------------------------------------------------------------------

# Default policy is DENY
# Explicitly accept desired INCOMING & OUTGOING connections

    # Remove all existing rules belonging to this filter
    iptables -F
    iptables -F -t nat

    # Remove any existing user-defined chains.
    iptables -X

    # Set the default policy of the filter to deny.
    iptables -P INPUT   DROP
    iptables -P OUTPUT  DROP
    iptables -P FORWARD DROP

# ----------------------------------------------------------------------------

# LOOPBACK
# --------

    # Unlimited traffic on the loopback interface.

    iptables -A INPUT  -i $LOOPBACK_INTERFACE  -j ACCEPT
    iptables -A OUTPUT -o $LOOPBACK_INTERFACE  -j ACCEPT

# ----------------------------------------------------------------------------

# Unlimited traffic within the local network.

    # All internal machines have access to the fireall machine.

    iptables -A INPUT  -i $LOCAL_INTERFACE_1 -s $INTRANET -j ACCEPT
    iptables -A OUTPUT -o $LOCAL_INTERFACE_1 -d $INTRANET -j ACCEPT

# ----------------------------------------------------------------------------

# STATEFUL PART!
# --------------

    # Kill malformed XMAS packets
    iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
    iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP

    # Kill malformed NULL packets
    iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
    iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP

    # Block faked, or "spoofed," packets from getting through the firewall.
    iptables -A FORWARD -i $LOCAL_INTERFACE_1 -s ! $INTRANET -j DROP

    # Allow all internal packets out of our network.
    iptables -A FORWARD -m state --state NEW -i $LOCAL_INTERFACE_1 \
         -s $INTRANET -j ACCEPT

    # Allow the associated packets with those connections back in.
    iptables -A FORWARD -m state --state ESTABLISHED,RELATED \
         -i $EXTERNAL_INTERFACE -s ! $INTRANET -j ACCEPT

    # All internal traffic is masqueraded externally.
    iptables -A POSTROUTING -t nat -o $EXTERNAL_INTERFACE -j MASQUERADE

# Blocks any forwards that come from Internet connection. Uncomment only for
# users with modem device like "ppp0".

#    iptables -A FORWARD -i $EXTERNAL_INTERFACE -m state \
#    --state NEW,INVALID -j REJECT

# ----------------------------------------------------------------------------

# Network Ghouls

    # Deny access to jerks
    # --------------------
    # /etc/rc.d/rc.firewall.blocked contains a list of
    # iptables -A INPUT -i $EXTERNAL_INTERFACE -s address -j DROP
    # rules to block from any access.

    # Refuse any connection from problem sites
    if [ -f /etc/rc.d/rc.firewall.blocked ]; then
    deny_file="/etc/rc.d/rc.firewall.blocked"
    temp_file="/tmp/temp.ip.addresses"
    cat $deny_file | sed -n -e "s/^[ ]*\([0-9.]*\).*$/\1/p" \
    | awk ' $1 ' > $temp_file
    while read ip_addy
    do
    case $ip_addy in
      *) iptables -A INPUT -i $EXTERNAL_INTERFACE -s $ip_addy -j DROP
         iptables -A INPUT -i $EXTERNAL_INTERFACE -d $ip_addy -j DROP
         iptables -A OUTPUT -o $EXTERNAL_INTERFACE -s $ip_addy -j REJECT
         iptables -A OUTPUT -o $EXTERNAL_INTERFACE -d $ip_addy -j REJECT
      ;;
     esac
    done < $temp_file
    rm -f $temp_file > /dev/null 2>&1
    unset temp_file
    unset deny_file
    fi

# ----------------------------------------------------------------------------

# SPOOFING & BAD ADDRESSES
# Refuse spoofed packets.
# Ignore blatantly illegal source addresses.
# Protect yourself from sending to bad addresses.

    # Refuse incoming packets pretending to be from the external address.
    iptables -A INPUT   -s $IPADDR -j DROP

    # Refuse incoming packets claiming to be from a Class A, B or C private network
    iptables -A INPUT   -s $CLASS_A -j DROP
    iptables -A INPUT   -s $CLASS_B -j DROP
#    iptables -A INPUT   -s $CLASS_C -j DROP

    # Refuse broadcast address SOURCE packets
    iptables -A INPUT   -s $BROADCAST_DEST -j DROP
    iptables -A INPUT   -d $BROADCAST_SRC -j DROP

    # Refuse Class D multicast addresses
    # Multicast is illegal as a source address.
    # Multicast uses UDP.
    iptables -A INPUT   -s $CLASS_D_MULTICAST -j DROP

    # Refuse Class E reserved IP  addresses
    iptables -A INPUT   -s $CLASS_E_RESERVED_NET -j DROP

    # Refuse special addresses defined as reserved by the IANA.
    # Note:  The remaining reserved addresses are not included
    # filtering them causes problems as reserved blocks are
    # being allocated more often now. The following are based on
    # reservations as listed by IANA as of 2001/01/04. Please regularly
    # check at http://www.iana.org/ for the latest status.

    # Note:  this list includes the loopback, multicast, & reserved addresses.

    # 0.*.*.*            - Can't be blocked for DHCP users.
    # 127.*.*.*          - LoopBack
    # 169.254.*.*          - Link Local Networks
    # 192.0.2.*          - TEST-NET
    # 224-255.*.*.*      - Classes D & E, plus unallocated.

    iptables -A INPUT   -s 0.0.0.0/8 -j DROP
    iptables -A INPUT   -s 127.0.0.0/8 -j DROP
    iptables -A INPUT   -s 169.254.0.0/16 -j DROP
    iptables -A INPUT   -s 192.0.2.0/24 -j DROP
    iptables -A INPUT   -s 224.0.0.0/3 -j DROP

# ----------------------------------------------------------------------------

    # UDP TRACEROUTE
    # --------------

    # traceroute usually uses -S 32769:65535 -D 33434:33523

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port $TRACEROUTE_SRC_PORTS \
         -d $IPADDR --destination-port $TRACEROUTE_DEST_PORTS -j DROP

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $TRACEROUTE_SRC_PORTS \
         --destination-port $TRACEROUTE_DEST_PORTS -j ACCEPT

# ----------------------------------------------------------------------------

    # DNS forward-only nameserver
    # ---------------------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $PRIMARY_NAMESERVER --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $PRIMARY_NAMESERVER --destination-port 53 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $PRIMARY_NAMESERVER --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $PRIMARY_NAMESERVER --destination-port 53 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         -s $SECONDARY_NAMESERVER --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $SECONDARY_NAMESERVER --destination-port 53 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $SECONDARY_NAMESERVER --source-port 53 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         -d $SECONDARY_NAMESERVER --destination-port 53 -j ACCEPT

    # ------------------------------------------------------------------

    # HTTP client (80)
    # ----------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 80 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 80 -j ACCEPT

    # ------------------------------------------------------------------

    # HTTPS client (443)
    # ------------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 443 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 443 -j ACCEPT

    # ------------------------------------------------------------------

    # WWW-CACHE client
    # ----------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#        --source-port 3128 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 3128 -j ACCEPT

    # ------------------------------------------------------------------

    # NNTP NEWS client (119)
    # ----------------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 119 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 119 -j ACCEPT

    # ------------------------------------------------------------------

    # POP client (110)
    # ----------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 110 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 110 -j ACCEPT

    # ------------------------------------------------------------------

    # IMAP client (143)
    # -----------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#        --source-port 143 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 143 -j ACCEPT

    # ------------------------------------------------------------------

    # SMTP client (25)
    # ----------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 25 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 25 -j ACCEPT

    # ------------------------------------------------------------------

    # SSH server (22)
    # ---------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port $SSH_REMOTE_PORTS \
         -d $IPADDR --destination-port 22 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $IPADDR --source-port 22 \
         --destination-port $SSH_REMOTE_PORTS -j ACCEPT


    # SSH client (22)
    # ---------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 22 \
         -d $IPADDR --destination-port $SSH_LOCAL_PORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $SSH_LOCAL_PORTS \
         --destination-port 22 -j ACCEPT

    # ------------------------------------------------------------------

    # TELNET client (23)
    # ------------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#       --source-port 23 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 23 -j ACCEPT

    # ------------------------------------------------------------------

    # AUTH server (113)
    # -----------------

    # Reject, rather than deny, the incoming auth port. (NET-3-HOWTO)
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port 113 -j REJECT


    # AUTH client (113)
    # -----------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#        --source-port 113 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 113 -j ACCEPT

    # ------------------------------------------------------------------

    # WHOIS client (43)
    # -----------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#        --source-port 43 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 43 -j ACCEPT

    # ------------------------------------------------------------------

    # FINGER client (79)
    # ------------------

#    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
#        --source-port 79 \
#        -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

#    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
#        -s $IPADDR --source-port $UNPRIVPORTS \
#        --destination-port 79 -j ACCEPT

    # ------------------------------------------------------------------

    # FTP client (21)
    # ---------------

    # outgoing request
    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 21 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 21 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT


    # PORT mode data channel
    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port 20 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp ! --syn \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 20 -j ACCEPT

    # ------------------------------------------------------------------

    # IRC client (6667)
    # -----------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 6667 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 6667 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # RealAudio / QuickTime client
    # ----------------------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 554 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 554 -j ACCEPT


    # TCP is a more secure method:  7070:7071

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 7070:7071 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 7070:7071 -j ACCEPT


    # UDP is the preferred method:  6970:6999
    # For LAN machines, UDP requires the RealAudio masquerading module and
    # the ipmasqadm third-party software.

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port $UNPRIVPORTS \
         -d $IPADDR --destination-port 6970:6999 -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port 6970:6999 \
         --destination-port $UNPRIVPORTS -j ACCEPT

    # ------------------------------------------------------------------

    # ICQ client (4000)
    # -----------------

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp ! --syn \
         --source-port 2000:4000 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 2000:4000 -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --source-port 4000 \
         -d $IPADDR --destination-port $UNPRIVPORTS -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p udp  \
         -s $IPADDR --source-port $UNPRIVPORTS \
         --destination-port 4000 -j ACCEPT

    # ------------------------------------------------------------------

    # SYSLOG client (514)
    # -------------------

#    iptables -A OUTPUT  -o $EXTERNAL_INTERFACE -p udp \
#        -s $IPADDR --source-port 514 \
#        -d $SYSLOG_SERVER --destination-port $UNPRIVPORTS -j ACCEPT

# ----------------------------------------------------------------------------

# ICMP

    #    To prevent denial of service attacks based on ICMP bombs, filter
    #    incoming Redirect (5) and outgoing Destination Unreachable (3).
    #    Note, however, disabling Destination Unreachable (3) is not
    #    advisable, as it is used to negotiate packet fragment size.

    # For bi-directional ping.
    #     Message Types:  Echo_Reply (0),  Echo_Request (8)
    #     To prevent attacks, limit the src addresses to your ISP range.
    #
    # For outgoing traceroute.
    #     Message Types:  INCOMING Dest_Unreachable (3), Time_Exceeded (11)
    #     default UDP base: 33434 to base+nhops-1
    #
    # For incoming traceroute.
    #     Message Types:  OUTGOING Dest_Unreachable (3), Time_Exceeded (11)
    #     To block this, deny OUTGOING 3 and 11

    #  0: echo-reply (pong)
    #  3: destination-unreachable, port-unreachable, fragmentation-needed, etc.
    #  4: source-quench
    #  5: redirect
    #  8: echo-request (ping)
    # 11: time-exceeded
    # 12: parameter-problem

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type echo-reply \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type destination-unreachable \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type source-quench \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type time-exceeded \
         -d $IPADDR -j ACCEPT

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type parameter-problem \
         -d $IPADDR -j ACCEPT


    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type fragmentation-needed -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type source-quench -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type echo-request -j ACCEPT

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE -p icmp  \
         -s $IPADDR --icmp-type parameter-problem -j ACCEPT

# ----------------------------------------------------------------------------

# Enable logging for selected denied packets

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p tcp  -j DROP

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --destination-port $PRIVPORTS -j DROP

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p udp  \
         --destination-port $UNPRIVPORTS -j DROP


    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type 5 -j DROP

    iptables -A INPUT  -i $EXTERNAL_INTERFACE -p icmp  \
         --icmp-type 13/255 -j DROP

    iptables -A OUTPUT -o $EXTERNAL_INTERFACE  -j REJECT

# ----------------------------------------------------------------------------

      ;;
  stop)
      echo -n "Shutting Firewalling: "

    # Remove all existing rules belonging to this filter
    iptables -F

    # Delete all user-defined chain to this filter
    iptables -X

    # Reset the default policy of the filter to accept.
    iptables -P INPUT   ACCEPT
    iptables -P OUTPUT  ACCEPT
    iptables -P FORWARD ACCEPT

      ;;
  status)
      status iptables
      ;;
  restart|reload)
      $0 stop
      $0 start
      ;;
  *)
      echo "Usage: iptables {start|stop|status|restart|reload}"
      exit 1
esac
echo "done"

exit 0
woensdag 8 augustus 2001 16:56
Acties:
Verwijderd
Volgens mij ligt het probleem aan deze regel
# Allow all internal packets out of our network.
iptables -A FORWARD -m state --state NEW -i $LOCAL_INTERFACE_1 \
-s $INTRANET -j ACCEPT
die --state moet worden
--state NEW,RELATED,ESTABLISHED
woensdag 8 augustus 2001 19:05
Acties:
Verwijderd
Yep, zo te zien is dat het probleem.

Er is geen forward rule voor verkeer dat bij een bestaande connectie hoort naar buiten. Alleen een regel voor verkeer dat van buitenaf weer naar binnen komt.

O[verigens kan je ook wat met logging en verschillende log-prefixen werken om zo in je logfiles te zien, welke deny/drop regel het verkeer tegen houdt.
woensdag 8 augustus 2001 23:08
Acties:
B2
wa' seggie?
Topicstarter
Yep dat was het !
Thx man